1. MICHAEL ARNOLD DENNIS KIKER The Big Data Challenges of Little Mobile Devices

2. What We Are Not Going to Cover Proliferation of mobile data Case law on data collection Your lips are moving, but all I hear is… blah, blah, blah

3. What We Are Going to Cover Fact Pattern o Personal injury litigation o Automobile accident o iPhone data collected by “expert” o Screen broken o Battery dead o Motion in limine to exclude iPhone data

7. Collection Method Use Cases Manual / File Level Extraction Limited to what is visible and accessible on device. (e.g. Pictures or even just possession) Simple litigation, where mobile device data is supplemental. Logical Collection Does not recover deleted files, or (slack) space. Typical litigation from general corporate to family and civil. May still yield extended data such as GPS, history, timestamps etc. Physical (Hex Dump) Ensures complete device retention, however is more complex to analyze. IP, Data Leak, Criminal, Human rights, uncooperative custodians and damaged or encrypted devices. Physical (Chip-Off) Considered destructive analysis/testing. May be required when phone is extensively damaged, but merits of case justify increased cost. Physical (Micro Read) Destructive analysis/testing – VERY costly and time consuming. Limited resources. Reserved for the highest value criminal cases (e.g. Government, Terror etc.)

8. GPS Coordinates - Native

9. GPS Coordinates - Mapped

10. Where to Find Help Assembly of documents and references, available at: http://bit.ly/JOLTMobileDeviceData Draft Guidelines on Mobile Device Forensics Recommendations of the National Institute of Standards and Technology Cellular Phone Evidence Data Extraction and Documentation Developing Process for the Examination of Cellular Phone Evidence Scientific Working Group on Digital Evidence Core Competencies for Mobile Phone Forensics SANS Institute Reading room – Forensic analysis of IOS Devices Practical Mobile Forensics Paperback – July 21, 2014 (Book Reference)